CVE-2026-33033
MEDIUMDjango < 6.0.4, 5.2.13, 4.2.30 - MultiPartParser Base64 Upload Denial of Service
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2026-33033. PoCs published by adminlove520, ch4n3-yoon.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-33033, a denial-of-service vulnerability in Django's `MultiPartParser` caused by excessive CPU usage during base64-encoded file uploads with whitespace. The exploit demonstrates a ~2,100x CPU amplification factor, tying up Django workers for extended periods.
Description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Exploits (2)
This repository contains a functional exploit for CVE-2026-33033, a denial-of-service vulnerability in Django's `MultiPartParser` caused by excessive CPU usage during base64-encoded file uploads with whitespace. The exploit demonstrates a ~2,100x CPU amplification factor, tying up Django workers for extended periods.
This repository contains a functional exploit PoC for CVE-2026-33033, a DoS vulnerability in Django's `MultiPartParser` caused by excessive CPU amplification during base64-encoded file uploads with whitespace. The exploit demonstrates how a 2.5 MB request can tie up a Django worker for ~5 seconds due to inefficient byte-by-byte processing.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H